Principal Security Governance & Audit Specialist

You will create our Common Control Framework (CCF) and run the governance engine around it: one set of controls, defined once and mapped to every certification we hold or pursue. You will own the policy library, exception process, framework intake and strategic reporting, and keep the CCF current as standards change.

Because governance only works if controls survive an audit, you will also work closely with the Audit & Assurance pillar. You will understand how controls are tested and evidenced, so that what Governance defines is auditable and what Audit finds feeds back into the CCF. You will join a lean team and work with Compliance Engineering, Legal, Privacy, Sales and external auditors.

• Common Control Framework. Build the CCF from 0 to 1 (highest priority): define the control structure and ownership model, write one set of engineering-ready controls mapped to SOC 2, ISO 27001, PCI DSS, HIPAA, FedRAMP and other frameworks, set the rollout plan, and keep it current as standards change.